Any security headers not mentioned in withHeaders will use the usual configured values(if present) or the defaults. Action-specific security headers are ignored unlessplay.filters.headers.allowActionSpecificHeaders is set to true in the configuration.